41e745815d4710d935c38ef1d0585ee6a922f31a6bfe1a673377060c4b79e788

Analysis

max time kernel
175s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:58

Target

0dac08132d0abbfcb39b19ceae89e963.dll
Size

79KB
MD5

0dac08132d0abbfcb39b19ceae89e963
SHA1

ed656e96f864976d2ca54010cc4da29dde1db439
SHA256

41e745815d4710d935c38ef1d0585ee6a922f31a6bfe1a673377060c4b79e788
SHA512

df525d3ea2dfbd76838768d3e6b2c73fb130aa8c857d7936af54f7bb8fc24df024ecebfcac660fe46c55951d2b8cc6e6ce46315d9558fecb3e2b378495226ff2
SSDEEP

768:crMbDGUYXPd0KGa/L7lOy/5up+n8a4v6gTFO6CCF+yyq9QKeyf2KS9VwnKx:5KUaSaHQy4p+n8a2FkK+yhQGK

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4396	4332	rundll32.exe	55
PID 4332 wrote to memory of 4396	4332	rundll32.exe	55
PID 4332 wrote to memory of 4396	4332	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dac08132d0abbfcb39b19ceae89e963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dac08132d0abbfcb39b19ceae89e963.dll,#1
  2⤵
  PID:4396

memory/4396-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download